flatted vulnerable to unbounded recursion DoS in parse() revive phase

🗓️ 13 Mar 2026 15:40:42Reported by GitHub Advisory DatabaseType

Flatted.parse() can crash apps from unbounded recursion in revive for circular refs; iterative fix.

Reporter	Title	Published	Views	Family All 53
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM watsonx Code Assistant On Prem	23 Mar 202615:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities	27 Apr 202613:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Edge Application Manager	23 Apr 202619:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D	27 Apr 202616:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses flatted-3.3.1.tgz, flatted-3.3.2.tgz which is vulnerable to CVE-2026-32141.	4 May 202606:52	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	13 May 202617:54	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of flatted, IBM DevOps Solution Workbench is affected by a stack overflow that crashes the Node.js process (CVE-2026-32141)	18 Mar 202615:18	–	ibm
ATTACKERKB	CVE-2026-32141	12 Mar 202618:08	–	attackerkb
Chainguard	CVE-2026-32141 vulnerabilities	18 Mar 202601:17	–	cgr
Circl	CVE-2026-32141	12 Mar 202608:19	–	circl

Vulners

Node

Source	Link
github	www.github.com/WebReflection/flatted/security/advisories/GHSA-25h7-pfq9-p65f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-32141
github	www.github.com/WebReflection/flatted/pull/88
github	www.github.com/WebReflection/flatted/commit/7eb65d857e1a40de11c47461cdbc8541449f0606
github	www.github.com/advisories/GHSA-25h7-pfq9-p65f

13 Mar 2026 15:40Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00022

SSVC